# NoName eCommerce - Mesh Network Route Map

**Version:** 3.1 
**Classification:** OPERATIONS - Mesh Topology & Routing 
**Last Updated:** 2026-06-20 
**Maintainer:** Infrastructure Team 

---

## Table of Contents

1. [Overview](#1-overview)
2. [Node Registry](#2-node-registry)
3. [Network Topology](#3-network-topology)
 - 3.1 [Logical Architecture](#31-logical-architecture)
 - 3.2 [Physical Topology](#32-physical-topology)
 - 3.3 [Mesh Diagram](#33-mesh-diagram)
4. [WireGuard Tunnels](#4-wireguard-tunnels)
 - 4.1 [wg7 - Primary Mesh](#41-wg7--primary-mesh)
 - 4.2 [lantern - Origin-Payment Direct Bridge](#42-lantern--origin-payment-direct-bridge)
5. [Routing Tables](#5-routing-tables)
 - 5.1 [Per-Node Routing](#51-per-node-routing)
 - 5.2 [Static Routes](#52-static-routes)
6. [Traffic Flow Chains](#6-traffic-flow-chains)
 - 6.1 [Primary Ingress Flow](#61-primary-ingress-flow)
 - 6.2 [Payment Processing Flow](#62-payment-processing-flow)
 - 6.3 [Administration Flow](#63-administration-flow)
 - 6.4 [DDoS Failover Flow](#64-ddos-failover-flow)
 - 6.5 [Engine API Flow](#65-engine-api-flow)
 - 6.6 [Email Processing Flow](#66-email-processing-flow)
7. [Nginx Proxy Chain](#7-nginx-proxy-chain)
 - 7.1 [Proxy (002) Configuration](#71-proxy-002-configuration)
 - 7.2 [Filter (003) Configuration](#72-filter-003-configuration)
 - 7.3 [Shield (004) Configuration](#73-shield-004-configuration)
 - 7.4 [Origin (005) Configuration](#74-origin-005-configuration)
8. [Firewall & iptables Rules](#8-firewall--iptables-rules)
 - 8.1 [Shield PostUp Rules](#81-shield-postup-rules)
 - 8.2 [firewalld Zone Configuration](#82-firewalld-zone-configuration)
 - 8.3 [Node-Specific Rules](#83-node-specific-rules)
9. [Allowed Paths Matrix](#9-allowed-paths-matrix)
10. [Endpoint & Port Reference](#10-endpoint--port-reference)
11. [HMAC Inter-Node Authentication](#11-hmac-inter-node-authentication)
12. [Decoy Configuration Reference](#12-decoy-configuration-reference)
13. [Appendix](#13-appendix)

---

## 1. Overview

The NoName eCommerce mesh network is a defense-in-depth network architecture comprising eight specialized nodes across six geographic locations. The network employs a layered security model with WireGuard mesh VPNs, chained nginx reverse proxies, iptables packet filtering, and HMAC inter-node authentication. All internal traffic traverses encrypted tunnels - no public IP addresses appear in inter-node configuration.

### Design Principles

| Principle                        | Implementation                                               |
| -------------------------------- | ------------------------------------------------------------ |
| No public IPs in inter-node code | All node-to-node traffic via WireGuard WG IPs                |
| Origin isolation                 | Origin (005) NEVER contacts nodes via public IP              |
| Layered defense                  | 8-node defense chain with inspection at each hop             |
| Encrypted mesh                   | All tunnels use WireGuard with Curve25519                    |
| HMAC validation                  | Every inter-node request authenticated via HMAC-SHA256       |
| Hub-and-spoke primary            | wg7 uses Shield (004) as central hub                         |
| Direct side tunnels              | Specialized tunnels bypass Shield for latency-critical paths |

---

## 2. Node Registry

| ID  | Internal ID | Role                       | Public IP               | WG IP         | OS           | Location                   |                             |
| --- | ----------- | -------------------------- | ----------------------- | ------------- | ------------ | -------------------------- | --------------------------- |
| 001 | 199335      | DNS                        | 80.78.19.57             | 10.69.69.5/32 | Ubuntu 24.04 | Sweden                     |                             |
| 002 | 244939      | PROXY                      | 107.189.23.194          | 10.69.69.3/32 | Alma Linux 9 | Amsterdam                  |                             |
| 003 | 333941      | FILTER                     | 91.229.239.29           | 10.69.69.4/32 | Alma Linux 9 | Moldova                    |                             |
| 004 | 414342      | SHIELD                     | 194.36.190.111          | 10.69.69.1/32 | Alma Linux 9 | Amsterdam                  |                             |
| 005 | 558201      | ORIGIN                     | 89.127.235.207          | 10.69.69.2/32 | Alma Linux 9 | Iceland                    |                             |
| 006 | 669427      | ENGINE                     | 76.13.222.157           | 10.69.69.6/32 | Alma Linux 9 | Malaysia                   |                             |
| 007 | 773816      | EMAIL (**DECOMMISSIONED**) | 76.13.222.157           | -             | Alma Linux 9 | Malaysia (shared with 006) | is_reachable=0, is_active=0 |
| 008 | 869377      | VAULT                      | 104.194.144.66          | 10.69.69.8/32 | Alma Linux 9 | London                     |                             |
| 009 | 714820      | PAYMENT                    | 45.143.166.118          | 10.69.69.7/32 | AlmaLinux 9.6 | Holland                    |                             |

### Role Descriptions

| Role          | Function                                                                                                                                        | Trust Zone       |
| ------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | ---------------- |
| DNS (001)     | Name resolution, failover control, DNS-based traffic steering                                                                                   | Edge             |
| PROXY (002)   | Edge caching, TLS termination, first contact, blackhole enforcement                                                                             | Edge             |
| FILTER (003)  | Traffic analysis, GeoIP filtering, bot detection, DDoS mitigation, ghost-protocol                                                               | Inspection       |
| SHIELD (004)  | Final gate, WireGuard tunnel hub, reverse proxy, HMAC validator                                                                                 | Hub/Gateway      |
| ORIGIN (005)  | Dashboard + storefront (HIDDEN), PHP-FPM application server                                                                                     | Core - Protected |
| ENGINE (006)  | C++ engine, payment processing, email service (migrated from 007)                                                                               | Core - Critical  |
| EMAIL (007)   | ~~IMAP scanning, SMTP relay, e-transfer detection~~ **DECOMMISSIONED** - email service now runs on Engine (669427). is_reachable=0, is_active=0 | Core - Auxiliary |
| VAULT (008)   | Credential Vault (encrypted key storage)                                                                                                        | Core - Critical  |
| PAYMENT (009) | Stripe payment processing, direct rain tunnel                                                                                                   | Core - Critical  |

---

## 3. Network Topology

### 3.1 Logical Architecture

The network follows a **defense-in-depth layered model** with traffic traversing seven layers from ingress to core. Each layer adds inspection, filtering, or authentication before forwarding to the next.

```
Layer 1 DNS Name resolution, geo-steering, failover DNS records
Layer 2 PROXY Edge TLS termination, cache layer, blackhole mode
Layer 3 FILTER GeoIP (Canada-only), bot detection (35+ UA patterns), ghost-protocol
Layer 4 SHIELD Final gate, WireGuard hub, HMAC validation, transparent relay
Layer 5 ORIGIN Dashboard + storefront (HIDDEN), PHP-FPM via unix socket
Layer 6 ENGINE C++ engine, crypto wallets, payment processing engine
Layer 7 EMAIL IMAP scanning, SMTP relay, e-transfer detection
```

### 3.2 Physical Topology

Sweden Amsterdam Moldova
 80.78.19.57 107.189.23.194 91.229.239.29
+---------+ +---------+ +---------+
| DNS    |     | PROXY  |                | FILTER |
| 001    |     | 002    |                | 003    |
| 10.69. |     | 10.69. |                | 10.69. |
| 69.5   |     | 69.3   |                | 69.4   |
+---------+ +----+----+ +----+----+
                        |                       |
                        | wg7                   | wg7
                        |                       |
                        v                       v
Iceland                Amsterdam              Malaysia
89.127.235.207         194.36.190.111         76.13.222.157
+---------+ +---------+ +---------+---------+
| ORIGIN | <-------> | SHIELD | <-----------> | ENGINE | EMAIL  |
| 005    | wg7       | 004    | wg7            | 006    | 007    |
| 10.69. | mesh      | 10.69. | hub-and-       | 10.69. | 10.69. |
| 69.2   |           | 69.1   | spoke          | 69.6   | 69.7   |
+----+----+ +----+----+ +----+----+---------+
 |                                        |
 | lantern                                |
 | 172.28.41.0                            |
 | /30                                    |
 |                                        |
 +----------------------------------------+

### 3.3 Mesh Diagram

```
 +---------+
 | DNS |
 | 001 |
 |10.69.69.5|
 +----+----+
 |
 | wg7
 v
 +---------+
 | PROXY |
 | 002 |
 | 10.69.69.3 |
 +----+----+
 |
 | wg7
 v
 +---------+ +---------+
 | FILTER | <-------+-------> | ENGINE |
 | 003 | wg7 | 006 |
 | 10.69.69.4 | | 10.69.69.6 |
 +---------+---------+ | +---------+---------+
 | | |
 | v |
 | +---------+ |
 | | SHIELD | |
 +----------->| 004 |<-------------+
 wg7 |10.69.69.1| wg7
 +----+----+
 |
 | wg7
 v
 +---------+
 | ORIGIN |
 | 005 |
 |10.69.69.2|
 +----+----+
 |
 | lantern
 v
 +---------+
 | ENGINE |
 | 006 |
 |172.28.41.2|
 +---------+

 lantern: ORIGIN 005 <-> ENGINE 006 (172.28.41.0/30, TCP bridge port 8301)

Shared host: ENGINE 006 + EMAIL 007 share 76.13.222.157 (Malaysia)
 EMAIL 007: 10.69.69.7 via wg7 only
```

---

## 4. WireGuard Tunnels

### 4.1 wg7 - Primary Mesh

| Attribute   | Value                                          |
| ----------- | ---------------------------------------------- |
| Interface   | `wg7`                                          |
| Subnet      | `10.69.69.0/24`                                |
| Listen Port | `41820`                                        |
| Topology    | Hub-and-spoke (Shield 004 as center)           |
| Nodes       | ALL (001, 002, 003, 004, 005, 006, 007)        |
| Purpose     | Primary mesh VPN - all node intercommunication |

**Allowed IPs per peer:**

| Node         | WG IP      | Allowed IPs                      |
| ------------ | ---------- | -------------------------------- |
| DNS (001)    | 10.69.69.5 | 10.69.69.5/32                    |
| PROXY (002)  | 10.69.69.3 | 10.69.69.3/32                    |
| FILTER (003) | 10.69.69.4 | 10.69.69.4/32                    |
| SHIELD (004) | 10.69.69.1 | 10.69.69.1/32 (hub - routes all) |
| ORIGIN (005) | 10.69.69.2 | 10.69.69.2/32                    |
| ENGINE (006) | 10.69.69.6 | 10.69.69.6/32                    |
| EMAIL (007)  | 10.69.69.7 | 10.69.69.7/32                    |

**Hub routing behavior:** Shield (004) routes traffic between spoke nodes. All spokes send default inter-node traffic via Shield unless a more specific route exists (e.g., direct tunnel).



### 4.2 lantern - Origin-Payment Direct Bridge

| Attribute   | Value                                            |
| ----------- | ------------------------------------------------ |
| Interface   | `lantern`                                      |
| Subnet      | `172.28.41.0/30`                                 |
| Listen Port | `39471` (Origin side)                            |
| Topology    | Point-to-point                                   |
| Nodes       | ORIGIN (005), ENGINE (006)                       |
| Purpose     | C++ engine TCP bridge - bypasses Shield entirely |

**Addressing:**

| Node         | Address        | Endpoint            |
| ------------ | -------------- | ------------------- |
| ORIGIN (005) | 172.28.41.1/30 | ListenPort 39471    |
| ENGINE (006) | 172.28.41.2/32 | 76.13.222.157:41938 |

**Critical traffic (raw TCP bridge):** `p1a2y3m4_bridge.php` (**LEGACY/REMOVED** - this file has been removed from production) uses port 8301 for direct C++ engine JSON-over-TCP calls. This tunnel is for legacy/low-level engine operations.

**HTTPS pay-relay (checkout.handler.php / PaymentBridge):** `checkout.handler.php` and `payment_bridge.php` use the HTTPS `pay-relay` at `:8443`. Primary path: `http://10.69.69.6:8443` (wg7 mesh). Fallback: `http://172.28.41.2:8443` (lantern). HMAC-SHA256 signed, HMAC response verification enabled as of 2026-06-18 audit.

**Note:** ENGINE (006) is the endpoint at 76.13.222.157 - shared with EMAIL (007).

### 4.3 Per-Store WireGuard Tunnels (NEW — 2026-06-20 Audit)

Per-store subnet isolation tunnels. Each store gets its own WireGuard interface between Origin and Proxy for traffic segregation (per NET-02, SERVICES.md §Subnet-Per-Store Architecture).

| Interface | Subnet          | Port | Nodes          | Purpose                      | Status  |
| --------- | --------------- | ---- | -------------- | ---------------------------- | ------- |
| `pebble`  | 10.69.70.0/30   | TBD  | Origin<->Proxy | cleanpharma.cc store traffic | Planned |
| `timber`  | 10.69.71.0/30   | TBD  | Origin<->Proxy | cleanearth.cc store traffic  | Planned |
| `thread`  | 10.69.72.0/30   | TBD  | Origin<->Proxy | cleansupply.cc store traffic | Planned |
| `compass` | 10.69.73.0/30   | TBD  | Origin<->Proxy | Future store traffic         | Pool    |
| `fossil`  | 10.69.74.0/30   | TBD  | Origin<->Proxy | Future store traffic         | Pool    |

**Architecture benefits:**
- nginx vhosts bind to specific WG IPs — no server_name conflicts
- Firewalld zone per store — compromised store can't leak traffic
- Per-store rate limiting at WG interface level
- One-command store takedown: `wg-quick down <interface>`
- Port assignments managed by `wg_port_allowlist` table (Engine DB)
- Subnet assignments managed by `wg_subnet_pool` table (Engine DB)

---

## 5. Routing Tables

### 5.1 Per-Node Routing

#### DNS (001) - Sweden

| Destination   | Gateway          | Interface | Metric | Notes           |
| ------------- | ---------------- | --------- | ------ | --------------- |
| 10.69.69.0/24 | 10.69.69.1       | wg7       | 100    | Via Shield hub  |
| 10.69.69.1/32 | -                | wg7       | 50     | Shield direct   |
| default       | (public gateway) | eth0      | 0      | Internet egress |

#### PROXY (002) - Amsterdam

| Destination    | Gateway          | Interface  | Metric | Notes                |
| -------------- | ---------------- | ---------- | ------ | -------------------- |
| 10.69.69.0/24  | 10.69.69.1       | wg7        | 100    | Via Shield hub       |
| 10.69.69.1/32  | -                | wg7        | 50     | Shield direct        |
| default        | (public gateway) | eth0       | 0      | Internet egress      |

#### FILTER (003) - Moldova

| Destination    | Gateway          | Interface | Metric | Notes                |
| -------------- | ---------------- | --------- | ------ | -------------------- |
| 10.69.69.0/24  | 10.69.69.1       | wg7       | 100    | Via Shield hub       |
| 10.69.69.1/32  | -                | wg7       | 50     | Shield direct        |
| default        | (public gateway) | eth0      | 0      | Internet egress      |

#### SHIELD (004) - Amsterdam (HUB)

| Destination    | Gateway          | Interface | Metric | Notes                        |
| -------------- | ---------------- | --------- | ------ | ---------------------------- |
| 10.69.69.0/24  | -                | wg7       | 0      | Local segment                |
| 10.69.69.1/32  | -                | wg7       | 0      | Local address                |
| 10.69.69.2/32  | -                | wg7       | 0      | Origin spoke                 |
| 10.69.69.3/32  | -                | wg7       | 0      | Proxy spoke                  |
| 10.69.69.4/32  | -                | wg7       | 0      | Filter spoke                 |
| 10.69.69.5/32  | -                | wg7       | 0      | DNS spoke                    |
| 10.69.69.6/32  | -                | wg7       | 0      | Engine spoke                 |
| 10.69.69.7/32  | -                | wg7       | 0      | Email spoke                  |
| default        | (public gateway) | eth0      | 0      | Internet egress + MASQUERADE |

**Shield as router:** All non-local wg7 traffic from spoke nodes transits through Shield. Shield performs IP forwarding and MASQUERADE on eth0.

#### ORIGIN (005) - Iceland

| Destination    | Gateway          | Interface | Metric | Notes                        |
| -------------- | ---------------- | --------- | ------ | ---------------------------- |
| 10.69.69.0/24  | 10.69.69.1       | wg7       | 100    | Via Shield hub               |
| 10.69.69.1/32  | -                | wg7       | 50     | Shield direct                |
| 10.69.69.2/32  | -                | wg7       | 0      | Local address                |
| 172.28.41.0/30 | -                | lantern | 50     | Origin-Payment bridge        |
| 172.28.41.1/32 | -                | lantern | 0      | Local address                |
| default        | (public gateway) | eth0      | 0      | Internet egress (restricted) |

**CRITICAL:** Origin NEVER initiates direct contact to other nodes via public IP. All inter-node traffic MUST traverse WireGuard.

#### ENGINE (006) - Malaysia

| Destination    | Gateway          | Interface  | Metric | Notes                 |
| -------------- | ---------------- | ---------- | ------ | --------------------- |
| 10.69.69.0/24  | 10.69.69.1       | wg7        | 100    | Via Shield hub        |
| 10.69.69.1/32  | -                | wg7        | 50     | Shield direct         |
| 10.69.69.6/32  | -                | wg7        | 0      | Local address         |
| 172.28.41.0/30 | -                | lantern  | 50     | Origin-Payment bridge |
| 172.28.41.2/32 | -                | lantern  | 0      | Local address         |
| default        | (public gateway) | eth0       | 0      | Internet egress       |

#### EMAIL (007) - Malaysia (shared host with 006)

| Destination   | Gateway          | Interface | Metric | Notes                  |
| ------------- | ---------------- | --------- | ------ | ---------------------- |
| 10.69.69.0/24 | 10.69.69.1       | wg7       | 100    | Via Shield hub         |
| 10.69.69.1/32 | -                | wg7       | 50     | Shield direct          |
| 10.69.69.7/32 | -                | wg7       | 0      | Local address          |
| 127.0.0.1     | -                | lo        | 0      | Local services only    |
| default       | (public gateway) | eth0      | 0      | Shared with ENGINE 006 |

### 5.2 Static Routes

| Route                       | Node                         | Interface  | Purpose                    |
| --------------------------- | ---------------------------- | ---------- | -------------------------- |
| 10.69.69.0/24 -> 10.69.69.1 | 001, 002, 003, 005, 006, 007 | wg7        | Default mesh route via hub |
| 172.28.41.0/30              | 005, 006                     | lantern  | TCP bridge (port 8301)     |

**Route precedence:** More specific routes override hub routing. Direct tunnels take precedence over wg7 hub paths.

---

## 6. Traffic Flow Chains

### 6.1 Primary Ingress Flow

```
INTERNET
 |
 | DNS query: A/AAAA record -> 80.78.19.57 (DNS 001)
 v
+---------+
| DNS 001    | Layer 1: Name resolution, failover control |
| 10.69.69.5 |                                            |
+----+----+
 |
 | HTTPS request -> 107.189.23.194 (PROXY 002)
 v
+---------+
| PROXY      | Layer 2: Edge caching, first contact, blackhole enforcement |
| 002        | - Cloudflare-mimicking edge headers                         |
| 10.69.69.3 | - TLS termination (if applicable)                           |
| 107.189.   | - Rate limiting, blackhole mode for attack traffic          |
| 23.194     |                                                             |
+----+----+
 |
 | Forward: 255.17.69.6:80 via shale tunnel
 v
+---------+
| FILTER     | Layer 3: Traffic analysis, DDoS mitigation, ghost-protocol |
| 003        | - GeoIP enforcement: Canada IP addresses ONLY              |
| 10.69.69.4 | - Bot detection: 35+ user-agent patterns blocked           |
| 91.229.239 | - Ghost-protocol: stealth response for probes              |
| .29        |                                                            |
+----+----+
 |
 | Forward: 10.69.69.1:80 via wg7
 v
+---------+
| SHIELD     | Layer 4: Final gate, reverse proxy, WireGuard hub |
| 004        | - HMAC validation before relay                    |
| 10.69.69.1 | - Transparent relay to origin                     |
| 194.36.190 | - Dashboard proxy on :8443 -> Origin :8443        |
| .111       |                                                   |
+----+----+
 |
 | Relay: 10.69.69.2:80
 v
+---------+
| ORIGIN     | Layer 5: Dashboard + storefront (HIDDEN)       |
| 005        | - PHP-FPM via unix socket                      |
| 10.69.69.2 | - Rejects direct access (non-mesh IPs blocked) |
| 89.127.235 | - Only accepts connections from 10.69.69.0/24  |
| .207       |                                                |
+---------+
```

### 6.2 Payment Processing Flow

```
+---------+ +---------+ +---------+
| ORIGIN |     | SHIELD |     | ENGINE |
| 005    |     | 004    |     | 006    |
+----+----+ +----+----+ +----+----+
 | | |
 | Option A: lantern | |
 | 172.28.41.0/30 | |
 |<------------------>| |
 | TCP bridge | |
 | port 8301 | |
 | | |
 | Option B: wg7 mesh | |
 | 10.69.69.0/24 | |
 |<----via Shield---->| |
 | (fallback) | |

Payment initiation flow (checkout.handler.php - 2026-06-18 audit):
 1. Customer completes checkout on Origin (005)
 2. checkout.handler.php calls PaymentBridge::submit(action, payload)
 3. PaymentBridge sends HMAC-signed POST to ENGINE pay-relay :8443 (primary: 10.69.69.6:8443, fallback: 172.28.41.2:8443)
 4. Engine (006) processes via C++ engine (noname-engine, port 8301 local)
 5. Engine communicates with crypto wallets (Monero/Tron)
 6. HMAC-verified response returned to Origin; order ref prefix: NN-XXXXXXXX

Note: Raw TCP bridge (p1a2y3m4_bridge.php, port 8301) is a separate code path for low-level engine operations only. **`p1a2y3m4_bridge.php` is LEGACY/REMOVED.**
```

### 6.3 Administration Flow

```
Admin workstation
 |
 | SSH port 9922
 v
+---------+ +---------+
| SHIELD     |            | ENGINE     |
| 004        | <--------> | 006        |
| 10.69.69.1 | wg7        | 10.69.69.6 |
| 194.36.190 |            | 76.13.222  |
| .111       |            | .157       |
+---------+ +---------+

Admin access paths:
 - SSH: admin -> Shield (004) -> ENGINE (006) port 9922 via wg7
 - Engine API: admin -> Shield -> ENGINE :8301 via wg7
 - Monitoring: admin -> Shield -> ENGINE (via wg7 hub)
 - Incident response: wg7 hub path
```

### 6.4 DDoS Failover Flow

```
Normal state:
+--------+ wg7 mesh +---------+ wg7 mesh +--------+
| PROXY | <------------> | SHIELD | <------------> | FILTER |
| 002   |                | 004    |                | 003    |
+--------+ +---------+ +--------+

DDoS active state (failover):
+--------+ shale +--------+
| PROXY | <-----------> | FILTER |
| 002   | direct         | 003    |
|       | failover       |        |
+--------+ +--------+
 |
 | (bypass Shield if needed)
 v
+---------+
| SHIELD |
| 004    |
+---------+

Failover triggers:
 - Shield (004) health check failure
 - Latency spike on wg7 > 2000ms
 - Packet loss > 10% on primary path
 - Manual activation via DNS control (001)
Activation: Standby peer config deployed, routes switch to shale
```

### 6.5 Engine API Flow

```
Any mesh node (001-007)
 |
 | HTTP request
 v
+---------+
| ENGINE     |                              |
| 006        |                              |
| 10.69.69.6 |                              |
| :8301      | HTTP API (all nodes allowed) |
+---------+
 |
 | Local services
 v
 +----------+ +----------+ +----------+
 | Monero | | Tron | | Ollama |
 | 18081 | | 9090 | | 11434 |
 | DISABLED | | DISABLED | | (local) |
 | 18082 | | | | |
 | DISABLED | | | | |
 +----------+ +----------+ +----------+

Engine local services (127.0.0.1 only unless noted):
 - Monero daemon: 0.0.0.0:18081 - **DISABLED** (removed 2026-06-16)
 - Monero wallet-rpc: 127.0.0.1:18082 - **DISABLED** (removed 2026-06-16)
 - Tron signer: 127.0.0.1:9090 - **DISABLED** (removed 2026-06-16)
 - Ollama: 127.0.0.1:11434 (local only)
 - Engine HTTP API: 0.0.0.0:8301 (mesh accessible)
```

### 6.6 Email Processing Flow

> [!CAUTION]
> **DECOMMISSIONED**: Email node 007 (773816) was decommissioned on 2026-06-19. The following section is retained for historical reference only. Do NOT use for operations.

```
INTERNET
 |
 | SMTP/IMAP traffic
 v
+---------+
| EMAIL      |                          |
| 007        |                          |
| 10.69.69.7 |                          |
| 76.13.222  | (shared with ENGINE 006) |
| .157       |                          |
+----+----+
 |
 | Local processing
 v
+----------+ +----------+ +----------+
| Postfix |     | Dovecot  |     | OpenDKIM |
| 587     |     | 110,143  |     | 8891     |
| SMTP    |     | IMAP     |     | signing  |
| relay   |     | scanning |     |          |
+----------+ +----------+ +----------+
 |
 | e-transfer detection results
 v
+---------+
| ENGINE | (via wg7 loopback on shared host) |
| 006    |                                   |
+---------+

Email services (007 - shared host with 006):
 - Postfix: port 587 (SMTP relay)
 - Dovecot: ports 110, 143 (IMAP scanning)
 - OpenDKIM: port 8891 (DKIM signing)
 - E-transfer detection: automated scanning for financial transfer indicators
```

---

## 7. Nginx Proxy Chain

### 7.1 Proxy (002) Configuration

```
Role: Cloudflare-mimicking edge proxy
Listen: 443 (HTTPS), 80 (HTTP redirect)
Upstream: 255.17.69.6:80 (Filter via shale tunnel)

Key behaviors:
 - Mimics Cloudflare response headers
 - Adds CF-Connecting-IP, CF-Ray style headers
 - Handles TLS termination at edge
 - Blackhole mode: returns 200 OK with empty body for attack signatures
 - Rate limiting: per-IP and global buckets
 - Geographic distribution via DNS steering (001)

nginx pseudo-config:
 server {
 listen 443 ssl;
 server_name _;

 ssl_certificate /path/to/cert.pem;
 ssl_certificate_key /path/to/key.pem;

 location / {
 proxy_pass http://255.17.69.6:80;
 proxy_set_header Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header CF-Connecting-IP $remote_addr;
 proxy_set_header CF-Ray $request_id;

 # Blackhole check
 if ($attack_signature) {
 return 200 "";
 }
 }
 }
```

### 7.2 Filter (003) Configuration

```
Role: GeoIP + bot detection filter
Listen: 80 (from Proxy), forwards to Shield
Upstream: 10.69.69.1:80 (Shield via wg7)

Key behaviors:
 - GeoIP enforcement: Canada IP addresses ONLY
 - Bot detection: 35+ user-agent patterns blocked
 - Ghost-protocol: returns ambiguous responses to probes
 - Traffic analysis logging
 - DDoS detection metrics

Filtering layers:
 1. Country code check (CA only)
 2. User-agent pattern matching (35+ blocked patterns)
 3. Request rate analysis
 4. Behavioral fingerprinting
 5. Ghost-protocol for failed checks (no explicit reject)

nginx pseudo-config:
 server {
 listen 80;
 server_name _;

 # GeoIP check - Canada only
 if ($geoip_country_code != "CA") {
 return 444; # Close connection without response
 }

 # Bot detection
 if $http_user_agent ~* (pattern1|pattern2|...|pattern35) {
 return 444;
 }

 location / {
 proxy_pass http://10.69.69.1:80;
 proxy_set_header Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 }
 }
```

### 7.3 Shield (004) Configuration

```
Role: Final gate + transparent relay + WireGuard hub
Listen: 80 (transparent relay), 8443 (dashboard proxy)
Upstream: 10.69.69.2:80 (Origin via wg7), 10.69.69.2:8443 (dashboard)

Key behaviors:
 - Transparent relay: minimal header manipulation
 - HMAC validation on inter-node endpoints
 - Dashboard proxy on :8443 to Origin :8443
 - wg7 hub: routes all spoke-to-spoke traffic

nginx pseudo-config:
 # Transparent relay - main site
 server {
 listen 80;
 server_name _;

 location / {
 # HMAC validation (if endpoint requires it)
 auth_request /hmac_validate;

 proxy_pass http://10.69.69.2:80;
 proxy_set_header Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 proxy_set_header X-Forwarded-Proto $scheme;
 }

 location = /hmac_validate {
 internal;
 proxy_pass http://127.0.0.1:8300; # HMAC validator
 }
 }

 # Dashboard proxy
 server {
 listen 8443 ssl;
 server_name _;

 ssl_certificate /path/to/dashboard-cert.pem;
 ssl_certificate_key /path/to/dashboard-key.pem;

 location / {
 proxy_pass https://10.69.69.2:8443;
 proxy_set_header Host $host;
 proxy_set_header X-Real-IP $remote_addr;
 }
 }
```

### 7.4 Origin (005) Configuration

```
Role: Application server (HIDDEN from direct access)
Listen: 80 (via Shield relay only), 8443 (dashboard)
Application: PHP-FPM via unix socket

Key behaviors:
 - Accepts ONLY mesh IPs (10.69.69.0/24)
 - Rejects all direct public IP connections
 - PHP-FPM via /run/php/php-fpm.sock
 - No public-facing server blocks

nginx pseudo-config:
 server {
 listen 80;
 server_name _;

 # Mesh-only access enforcement
 allow 10.69.69.0/24;
 deny all;

 root /var/www/html;
 index index.php;

 location ~ \.php$ {
 fastcgi_pass unix:/run/php/php-fpm.sock;
 fastcgi_index index.php;
 include fastcgi_params;
 }
 }

 server {
 listen 8443 ssl;
 server_name _;

 allow 10.69.69.0/24;
 deny all;

 ssl_certificate /path/to/cert.pem;
 ssl_certificate_key /path/to/key.pem;

 location / {
 root /var/www/dashboard;
 try_files $uri $uri/ /index.php;
 }
 }
```

---

## 8. Firewall & iptables Rules

### 8.1 Shield PostUp Rules

Applied on `wg7` interface bring-up on Shield (004):

```bash
# Accept forwarding from wg7 interface
iptables -A FORWARD -i wg7 -j ACCEPT

# Accept forwarding to wg7 interface
iptables -A FORWARD -o wg7 -j ACCEPT

# MASQUERADE outbound traffic on eth0
iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
```

**Effect:**
- All traffic arriving on `wg7` from spoke nodes is accepted for forwarding
- Shield acts as router between spoke nodes
- Outbound traffic to internet is NATed through Shield's public IP (194.36.190.111)
- Enables spoke nodes to reach internet through Shield (if configured)

### 8.2 firewalld Zone Configuration

**All nodes:** `10.69.69.0/24` is in the `trusted` zone.

```bash
# Applied on every node
firewall-cmd --zone=trusted --add-source=10.69.69.0/24 --permanent
firewall-cmd --reload
```

**Zone assignments:**

| Zone     | Sources          | Services              | Notes                   |
| -------- | ---------------- | --------------------- | ----------------------- |
| trusted  | 10.69.69.0/24    | All allowed           | Full mesh trust         |
| public   | (eth0)           | SSH (9922), WireGuard | Minimal public exposure |
| internal | (wg* interfaces) | All                   | Tunnel interfaces       |

**Standard firewalld rules per node:**

```bash
# Public zone - minimal
firewall-cmd --zone=public --add-port=9922/tcp --permanent # SSH
firewall-cmd --zone=public --add-port=41820/udp --permanent # wg7
firewall-cmd --zone=public --add-port=39471/udp --permanent # lantern

# Trusted zone - mesh
firewall-cmd --zone=trusted --add-source=10.69.69.0/24 --permanent

# Reload to apply
firewall-cmd --reload
```

### 8.3 Node-Specific Rules

#### DNS (001) - Additional rules

```bash
# DNS services
firewall-cmd --zone=public --add-service=dns --permanent
firewall-cmd --zone=public --add-port=53/tcp --permanent
firewall-cmd --zone=public --add-port=53/udp --permanent
```

#### PROXY (002) - Additional rules

```bash
# Web services
firewall-cmd --zone=public --add-service=http --permanent
firewall-cmd --zone=public --add-service=https --permanent
firewall-cmd --zone=public --add-port=80/tcp --permanent
firewall-cmd --zone=public --add-port=443/tcp --permanent
```

#### FILTER (003) - Additional rules

```bash
# No additional public ports - receives via tunnel from Proxy
# Internal forwarding only
```

#### SHIELD (004) - Additional rules

```bash
# Dashboard proxy
firewall-cmd --zone=trusted --add-port=8443/tcp --permanent

# IP forwarding (sysctl)
echo "net.ipv4.ip_forward=1" >> /etc/sysctl.conf
sysctl -p
```

#### ORIGIN (005) - Additional rules

```bash
# NO public web ports - only mesh access
# Origin specific: block all direct public access to web
firewall-cmd --zone=public --remove-service=http --permanent
firewall-cmd --zone=public --remove-service=https --permanent

# Dashboard accessible only via mesh
firewall-cmd --zone=trusted --add-port=8443/tcp --permanent
```

#### ENGINE (006) - Additional rules

```bash
# Engine API
firewall-cmd --zone=trusted --add-port=8301/tcp --permanent

# TCP bridge (lantern)
firewall-cmd --zone=trusted --add-port=8301/tcp --permanent

# Monero daemon - DISABLED (removed 2026-06-16)
# firewall-cmd --zone=trusted --add-port=18081/tcp --permanent

# Local services (localhost only, not in firewalld)
# wallet-rpc:127.0.0.1:18082 (DISABLED), tron-signer:127.0.0.1:9090 (DISABLED), ollama:127.0.0.1:11434
```

#### EMAIL (007) - Additional rules

```bash
# Mail services
firewall-cmd --zone=trusted --add-port=587/tcp --permanent # Postfix SMTP
firewall-cmd --zone=trusted --add-port=110/tcp --permanent # Dovecot POP
firewall-cmd --zone=trusted --add-port=143/tcp --permanent # Dovecot IMAP
firewall-cmd --zone=trusted --add-port=8891/tcp --permanent # OpenDKIM
```

---

## 9. Allowed Paths Matrix

### 9.1 Direct Communication Matrix

| From \ To      | 001 DNS | 002 PROXY        | 003 FILTER    | 004 SHIELD     | 005 ORIGIN         | 006 ENGINE         | 007 EMAIL         |
| -------------- | ------- | ---------------- | ------------- | -------------- | ------------------ | ------------------ | ----------------- |
| **001 DNS**    | -       | wg7              | wg7           | wg7            | wg7                | wg7                | wg7               |
| **002 PROXY**  | wg7     | -                | wg7           | wg7            | wg7                | wg7                | wg7               |
| **003 FILTER** | wg7     | wg7              | -             | wg7            | wg7                | wg7                | wg7               |
| **004 SHIELD** | wg7     | wg7              | wg7           | -              | wg7                | wg7                | wg7               |
| **005 ORIGIN** | wg7     | wg7              | wg7           | wg7            | -                  | lantern            | wg7               |
| **006 ENGINE** | wg7     | wg7              | wg7           | wg7            | lantern            | -                  | wg7 (shared host) |
| **007 EMAIL**  | wg7     | wg7              | wg7           | wg7            | wg7                | wg7 (shared host)  | -                 |

**Legend:**
- `wg7` - Via primary mesh hub (through Shield)
- `lantern` - Direct TCP bridge tunnel
- `shared host` - Loopback/localhost (same physical machine)

### 9.2 Service Access Matrix

| Service       | Listener    | Accessible From | Via            | Notes                 |
| ------------- | ----------- | --------------- | -------------- | --------------------- |
| DNS           | 001:53      | Internet        | Public         | Global DNS resolution |
| HTTPS edge    | 002:443     | Internet        | Public         | Cloudflare-mimicking  |
| HTTP internal | 003:80      | 002 only        | shale tunnel | Filter layer          |
| HTTP relay    | 004:80      | 003 only        | wg7            | Shield relay          |
| Dashboard     | 004:8443    | Admin           | wg7            | Proxy to Origin :8443 |
| HTTP app      | 005:80      | 004 only        | wg7            | PHP-FPM, mesh only    |
| Dashboard app | 005:8443    | 004 only        | wg7            | Dashboard backend     |
| Engine API    | 006:8301    | All mesh nodes  | wg7            | C++ engine HTTP       |
| TCP bridge    | 006:8301    | 005 only        | lantern      | Payment processing    |
| Monero daemon | 006:18081   | All mesh nodes  | wg7            | Full node             |
| Monero wallet | 006:18082   | 006 localhost   | lo             | Local only            |
| Tron signer   | 006:9090    | 006 localhost   | lo             | Local only            |
| Ollama        | 006:11434   | 006 localhost   | lo             | Local only            |
| SMTP relay    | 007:587     | Mesh nodes      | wg7            | Postfix               |
| IMAP          | 007:110,143 | Mesh nodes      | wg7            | Dovecot               |
| DKIM          | 007:8891    | 007 localhost   | lo             | OpenDKIM              |
| SSH           | ALL:9922    | Admin           | Public/Trusted | All nodes             |

### 9.3 Forbidden Paths

| Path                 | Reason                                      |
| -------------------- | ------------------------------------------- |
| Internet -> 003:80   | Filter not publicly accessible              |
| Internet -> 004:80   | Shield not publicly accessible              |
| Internet -> 005:*    | Origin completely hidden                    |
| Internet -> 006:*    | Engine completely hidden                    |
| Internet -> 007:*    | Email completely hidden                     |
| 005 -> * (public IP) | Origin never uses public IPs for inter-node |
| 005 -> 006 (public)  | Must use lantern or wg7                   |
| Any -> 006:18082     | Monero wallet localhost only                |
| Any -> 006:9090      | Tron signer localhost only                  |
| Any -> 006:11434     | Ollama localhost only                       |

---

## 10. Endpoint & Port Reference

### 10.1 Public Endpoints

| Node         | Public IP      | Open Ports      | Service                                                |
| ------------ | -------------- | --------------- | ------------------------------------------------------ |
| DNS (001)    | 80.78.19.57    | 53/udp, 53/tcp  | DNS resolution                                         |
| PROXY (002)  | 107.189.23.194 | 80/tcp, 443/tcp | HTTPS edge                                             |
| FILTER (003) | 91.229.239.29  | 9922/tcp        | SSH only (no public web)                               |
| SHIELD (004) | 194.36.190.111 | 9922/tcp        | SSH only (no public web)                               |
| ORIGIN (005) | 89.127.235.207 | 9922/tcp        | SSH only                                               |
| ENGINE (006) | 76.13.222.157  | 9922/tcp        | SSH only                                               |
| EMAIL (007)  | 76.13.222.157  | -               | **DECOMMISSIONED** - shared with 006, no direct public |
| VAULT (008)  | 104.194.144.66 | 9922/tcp        | Credential Vault (encrypted key storage)               |


### 10.2 WireGuard Endpoints

| Tunnel     | Port  | Node A (Listener) | Node B (Endpoint)   |
| ---------- | ----- | ----------------- | ------------------- |
| wg7        | 41820 | All nodes         | Shield (004) as hub |
| lantern  | 39471 | ORIGIN (005)      | ENGINE (006):41938  |

### 10.3 Service Port Reference

| Port           | Protocol | Node    | Service           | Scope                                                |
| -------------- | -------- | ------- | ----------------- | ---------------------------------------------------- |
| 53             | UDP/TCP  | 001     | DNS               | Public                                               |
| 80             | TCP      | 002     | HTTP edge         | Public                                               |
| 443            | TCP      | 002     | HTTPS edge        | Public                                               |
| 255.17.69.6:80 | TCP      | 003     | Filter upstream   | shale tunnel                                       |
| 41820          | UDP      | ALL     | wg7 mesh          | Public                                               |
| 8443           | TCP      | 004/005 | Dashboard proxy   | Mesh only                                            |
| 9922           | TCP      | ALL     | SSH               | Public (restricted)                                  |
| 39471          | UDP      | 005/006 | lantern           | Public                                               |
| 8301           | TCP      | 006     | Engine HTTP API   | Mesh                                                 |
| 8301           | TCP      | 006     | TCP bridge        | lantern                                            |
| 18081          | TCP      | 006     | Monero daemon     | ~~Mesh~~ **DISABLED** (removed 2026-06-16)           |
| 18082          | TCP      | 006     | Monero wallet-rpc | ~~Localhost only~~ **DISABLED** (removed 2026-06-16) |
| 9090           | TCP      | 006     | Tron signer       | ~~Localhost only~~ **DISABLED** (removed 2026-06-16) |
| 11434          | TCP      | 006     | Ollama            | Localhost only                                       |
| 587            | TCP      | 007     | Postfix SMTP      | Mesh                                                 |
| 110            | TCP      | 007     | Dovecot POP       | Mesh                                                 |
| 143            | TCP      | 007     | Dovecot IMAP      | Mesh                                                 |
| 8891           | TCP      | 007     | OpenDKIM          | Localhost only                                       |

---

## 11. HMAC Inter-Node Authentication

### 11.1 Protocol Specification

| Attribute           | Value                    |     |         |     |           |
| ------------------- | ------------------------ | --- | ------- | --- | --------- |
| Algorithm           | HMAC-SHA256              |     |         |     |           |
| Key derivation      | ECDH over WireGuard keys |     |         |     |           |
| Timestamp tolerance | 30 seconds               |     |         |     |           |
| Nonce size          | 128-bit random           |     |         |     |           |
| Format              | `HMAC(key, timestamp \   | \   | nonce \ | \   | payload)` |

### 11.2 Verification Flow

```
Sending node:
 1. Generate 128-bit random nonce
 2. Get current Unix timestamp
 3. Concatenate: timestamp || nonce || payload
 4. Compute HMAC-SHA256 with ECDH-derived key
 5. Send: payload + timestamp + nonce + HMAC

Receiving node (Shield validates before relay):
 1. Extract timestamp, nonce, payload, HMAC
 2. Check timestamp within 30-second window
 3. Recompute HMAC with shared key
 4. Compare computed HMAC with received HMAC
 5. If valid, relay to destination
 6. If invalid, drop and log
```

### 11.3 Shield HMAC Validation

Shield (004) validates HMAC on all inter-node relay requests before forwarding:

```
[Node A] --HMAC request--> [Shield 004] --validate--> [relay] --HMAC request--> [Node B]
 |
 v
 Invalid? DROP + LOG
```

**Scope:** HMAC validation applies to authenticated endpoints only. Public-facing endpoints (DNS, HTTPS edge) do not require HMAC.

---

## 12. Decoy Configuration Reference

### 12.1 Decommissioned Configurations

| Item                   | Status         | Details                                     |
| ---------------------- | -------------- | ------------------------------------------- |
| Origin `wg0` interface | DECOMMISSIONED | Was pointing to old Shield at 92.113.124.34 — **REMOVED, DO NOT USE** |

> [!WARNING]
> `92.113.124.34` is the OLD Shield public IP and is fully decommissioned. Current Shield IP is `194.36.190.111`. Remove any remaining references from all configurations.

### 12.2 Decoy/Honey Endpoints

| Decoy                    | Location     | Purpose                                              |
| ------------------------ | ------------ | ---------------------------------------------------- |
| Ghost protocol responses | Filter (003) | Ambiguous HTTP responses to automated probes         |
| Blackhole mode           | Proxy (002)  | Returns 200 OK with empty body for attack patterns   |
| CF-mimicking headers     | Proxy (002)  | Appears as Cloudflare-protected to casual inspection |

### 12.3 Ghost-Protocol Behavior

When Filter (003) detects probing or scanning:

```
Probe request:
 GET /admin HTTP/1.1
 User-Agent: Nmap Scripting Engine

Ghost-protocol response:
 HTTP/1.1 200 OK
 Server: nginx
 Content-Length: 0

 (empty body - no information leaked)
```

### 12.4 Blackhole Mode

Activated on Proxy (002) under high-volume attack:

```
Attack traffic signature detected:
 - Request rate > threshold
 - Pattern match in URI or headers
 - Known bot fingerprint

Blackhole response:
 HTTP/1.1 200 OK
 Content-Type: text/plain
 Content-Length: 0

 (empty body, minimal processing cost)
```

---

## 13. Appendix

### 13.1 Interface Naming Convention

| Interface    | Purpose              | Scope          |
| ------------ | -------------------- | -------------- |
| `eth0`       | Public internet      | All nodes      |
| `wg7`        | Primary mesh VPN     | All nodes      |
| `lantern`  | TCP bridge           | ORIGIN, ENGINE |
| `lo`         | Localhost services   | All nodes      |

### 13.2 Subnet Allocation Summary

| Subnet      | Mask            | CIDR | Purpose               |
| ----------- | --------------- | ---- | --------------------- |
| 10.69.69.0  | 255.255.255.0   | /24  | Primary mesh (wg7)    |
| 172.28.41.0 | 255.255.255.252 | /30  | Origin-Payment bridge |

### 13.3 Geographic Distribution

| Location  | Nodes                     | Public IP Range                |
| --------- | ------------------------- | ------------------------------ |
| Sweden    | DNS (001)                 | 80.78.19.57                    |
| Amsterdam | PROXY (002), SHIELD (004) | 107.189.23.194, 194.36.190.111 |
| Moldova   | FILTER (003)              | 91.229.239.29                  |
| Iceland   | ORIGIN (005)              | 89.127.235.207                 |
| Malaysia  | ENGINE (006), EMAIL (007) | 76.13.222.157 (shared)         |
| London    | VAULT (008)               | 104.194.144.66                 |

### 13.4 Change Log

| Version | Date       | Changes                                                                                                                                                               |
| ------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1.0     | 2024-XX-XX | Initial route map with 5-node topology                                                                                                                                |
| 1.5     | 2024-XX-XX | Added EMAIL (007), lantern tunnel                                                                                                                                   |
| 2.0     | 2025-01-15 | Complete rewrite: 7-node mesh, all tunnels, HMAC auth, full routing tables                                                                                            |
| 3.0     | 2026-06-20 | Zero-trust hardening: SSH port 9922, Origin IP updated, Filter IP updated, Vault node added, Email decommissioned, crypto services removed, svcauth/svcwatch deployed |
| 3.1     | 2026-07-02 | Documentation overhaul: Payment node (714820) added as node 009, Email (773816) fully decommissioned, node count corrected to 8, stale IPs removed, SSH port default corrected to 9922 |

### 13.5 Emergency Contacts & Procedures

| Scenario                | Action                                                |
| ----------------------- | ----------------------------------------------------- |
| Shield (004) down       | Activate shale direct path between 002 and 003   |
| Origin (005) compromise | Revoke Origin WG keys, isolate via Shield ACLs     |
| Engine (006) compromise | Disable lantern keys, revoke wg7 peer               |
| DNS (001) hijack        | Switch to backup DNS, verify all A records            |
| Full mesh failure       | Activate public IP whitelist mode (emergency bypass)  |

---

*End of document*
